An AI agent can complete a valid checkout and still place the wrong order. It might pick an unsuitable item, exceed a budget or act on preferences the user changed weeks ago. Nobody was at the keyboard to notice.
That is the real shift in agentic commerce. The click is no longer the decision. Instead, a person grants authority once and the agent spends it later, often many times. NIST notes that AI agents can act with limited human supervision and that greater autonomy brings new risks.
Merchants now face a question ordinary checkout controls were never built to answer. When an agent acts, how do you know a real human actually stands behind its authority?
Three Questions Every Agent Transaction Must Answer
Every agent purchase raises three separate questions. Merchants get into trouble when they treat one answer as proof of the other two.
- Who is acting? This is agent identity: which software made the request and which credential it used.
- What is it allowed to do? This is delegated authority: the merchants, items, amounts and time window the user approved.
- Did a real human authorize this? This is human authorization: whether a living person confirmed this specific consequential action.
Each layer catches a different failure. A recognized agent can still be working for an attacker. A valid delegation can still be stretched beyond what the user meant. A stored approval proves little if no real person was behind it.
Where Agentic Commerce Risks Actually Appear
Take a household agent told to reorder coffee, detergent and pet food when supplies run low. It has approved brands and a monthly budget. Here is how that simple job goes wrong.
The Agent is Compromised
An attacker takes over the account or steals the agent’s credential. Alternatively, misleading product data or an injected instruction changes what the agent thinks the user wants. The software is still the expected agent. Its behavior, however, no longer matches the user’s intent. A broad, long-lived credential gives that mismatch time to do damage.
The Delegation is Stretched
“Find a replacement charger” does not cover an unfamiliar model, a bundled subscription or express shipping. Yet an agent without a tight scope may choose all three. The user then disputes the charge, while the merchant sees a completed checkout. Mastercard frames clear user intent, secure credentials and verifiable agent identity as core trust needs for agentic commerce.
The Error Repeats
A recurring instruction turns one decision into many purchases. As a result, one bad preference can repeat every month before anyone notices.
The Evidence is Missing
Payment approval does not settle what happens next. The order may already have shipped. Refunds and chargebacks then depend on evidence linking the request, the agent’s actions, any approval and the final order. Without that chain, nobody can show the purchase was intended.
A Risk-to-Control Map for Agentic Commerce
Each risk calls for a control matched to the question it fails. No single check clears an order on its own.
| Risk | Failure mode | Proportional control | Question |
|---|---|---|---|
| Unclear agent identity | The merchant cannot tell which agent placed the order. | Authenticate the agent and bind its identity to the order record. | Who is acting? |
| Credential compromise | A stolen or misused credential enables checkout. | Issue short-lived scoped credentials, monitor use and revoke on change. | Who is acting? |
| Overbroad delegation | The agent buys outside the user's intended scope. | Limit merchant, item, amount and duration. Confirm when a limit is crossed. | What is allowed? |
| Abnormal purchase pattern | Repeated or high-value orders pass through unattended. | Monitor transactions, use reversible holds and route exceptions to a person. | What is allowed? |
| Impersonation or disputed intent | An order looks approved with no evidence a real person was involved. | Step up to a live human check at consequential moments and keep the approval record. | Was it a real human? |
Controls should also scale with context. A routine reorder inside the user’s budget can proceed with monitoring. A new merchant, unusual amount or irreversible purchase should trigger confirmation or a temporary hold.
Four Principles for Least-Privilege Agent Commerce
Scope Every Delegation to a Purchasing Job
Express permission in transaction terms. That means the merchant or category, the products, a maximum amount, a time window and whether repeat purchases are allowed. A request to restock coffee should never become permission to buy a laptop.
Give Agents Their Own Expiring Credentials
Assign each agent a distinct identity and a named accountable operator, never a shared service account. Issue short-lived credentials scoped to the task. Keep them out of prompts and logs, and make revocation immediate.
Pause Exceptions Instead of Widening Access
When a purchase crosses a limit, stop it and send the user a short summary. Their approval should cover that one exception. It should not quietly rewrite the agent’s standing permissions.
Keep the Evidence, Not the Data
For each material action, record the agent identity, the delegation that applied, any approval, the merchant, the amount and the outcome. That record resolves disputes. Raw personal data rarely does, so collect only what the decision needs. The NIST Privacy Framework is a useful lens for deciding where that line sits.
The Missing Layer: A Real Human at the Critical Moment
Agent authentication tells you which software is acting. Delegated authority tells you what it may do. Neither tells you whether a real person stands behind that authority when it counts.
Agent-side controls alone cannot close this gap. An attacker who controls an account can approve their own delegation. A synthetic identity can grant authority to an agent built to drain it. A setup approval from months ago says little about who is present today.
Human step-up closes it. At a consequential moment, the system asks a live, unique person to confirm the specific action. Consequential moments include high-value purchases, new merchants, changed delivery addresses and payment method changes. Routine reorders stay low-friction.
Two design rules matter here. First, show the real transaction: the merchant, items, total, delivery address and payment method. A vague “Allow agent to continue?” prompt is weak evidence of intent. Second, never treat a failed or abandoned check as approval. Pause the order instead.
This is where VerifEye fits. Protect adds a step-up check that confirms a real, unique human is present before a high-risk action goes through. It takes seconds and needs no documents. Reverify confirms it is the same person who set up the delegation in the first place. Both are built on privacy by design, so the check adds proof without adding a store of personal data.
Combined with agent identity and scoped permissions, this completes the chain. You have the right agent, doing an allowed thing, for a real person who said yes.
Building Trust Into Agentic Checkout
Agent identity and scoped authority are fast becoming baseline requirements. The human layer is what turns a completed checkout into a defensible one.
For a deeper look at the authorization record itself, see how to prove an AI action was authorized. To link agents to accountable people over time, see how to tie AI agents to an accountable human.